Repository navigation
Check the destination of requests sent through a forward proxy - #116
Merged
Merged
Conversation
safehttp.New clones http.DefaultTransport, which keeps ProxyFromEnvironment, and the address gate only wraps DialContext. With HTTP_PROXY or HTTPS_PROXY set the transport dials the forward proxy, so the gate checked the forward proxy's address and never the destination. newClient now also wraps transport.Proxy: for a request that goes to a forward proxy, the destination host is resolved and every address has to pass the same gate with the same Options. A name that cannot be resolved locally is still passed on, since some networks resolve public names only at the forward proxy. Direct requests are unchanged, and the TinyGo client is not affected. Fixes git-pkgs#115
simonchrz
added a commit
to simonchrz/proxy
that referenced
this pull request
Oct 24, 2026
registries' safehttp now checks the destination of requests sent through a forward proxy (git-pkgs/registries#116), so the proxy's own guard is removed and newUpstreamClient is back to its earlier form. go.mod points at a pseudo-version of registries main until git-pkgs#116 is released.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
safehttp.Newcloneshttp.DefaultTransport, which keepsProxyFromEnvironment, and the address gate only wrapsDialContext. WithHTTP_PROXYorHTTPS_PROXYset, the dial goes to the forward proxy, so only the forward proxy's address was checked, never the destination's.newClientnow wrapstransport.Proxynext to the dial gate. When a request is sent to a forward proxy, the destination host is resolved (IP literals are used as is) and every address has to pass the same gate with the sameOptions, so link-local stays blocked andAllowLoopback,AllowPrivateandAllowPrivateHostsbehave as for direct requests. A name that can't be resolved locally is still passed to the forward proxy, since some networks resolve public names only there. Direct requests are unchanged, and the TinyGo client is not affected.The tests route a client through a loopback forward proxy with a fake resolver: link-local and private destinations (literals and names) are refused before reaching it, while allowlisted private hosts, public hosts and unresolvable names go through.
Fixes #115